v0.9.10: ## 0.9.10 (2026-09-15)

0.9.10 (2026-09-15)

The final-blitz release: the audit lane executed, the guard hardened, the contract synced

The 2026-09-13 final audit's ranked list, worked top-down in one release.
Fork-side touches are logged under the cross-repo grant (#117): the series
double-render fix and the read-guard cleanup (e7949b95, cec662ab), plus the
vendored theme (ac000655). Fork suite 86 green throughout.

• The decorator counts are restated as wording (the HIGH). The
  correction-of-the-correction: the figures were family counts of
  @login_required_if_no_ano all along (39 across 5 modules at the 0.6.26
  base; 37 still upstream-side plus the fork's own 5 at HEAD, 42 across 10),
  and no doc said which spelling it meant. Spec 11.1/11.2 now name it and
  note admin.py's 94 route protections ride upstream's wrapper decorators;
  the 0.9.9 entry carries a dated erratum; README says the same in one
  breath.
• The dropdown menu is themed. The Bootstrap .dropdown-menu on the
  detail page (multi-format Download, Read/Listen in Browser) was the last
  stock-white surface; one rule block (black2 ground, hairline border, gray
  mono items, orange hover) in the canonical sheet, vendored by
  just sync-theme, verified against the real bootstrap cascade on a
  scratch page. Latent on the live instance until a 2+-format book exists
  (today's library has none); recorded so nobody expects to see it tomorrow.
• The cover read tick keeps its icon font. .badge.glyphicon re-pins
  Glyphicons Halflings past the mono badge rules (0-2-0 had beaten 0-1-0);
  the \e013 checkmark no longer depends on an installed Nerd Font.
  Computed style verified on the live app.
• check-theme is hardened, and guards itself. The full 148-name colour
  list (whitesmoke no longer sails through), the modern notation set
  refused (oklch/lab/lch/hwb/color/color-mix/light-dark/device-cmyk), raw
  hex outside :root fails outright (the old check subtracted root_hexes, so
  a declared mid-file hex passed), --mono pinned symmetrically with
  --serif, brace-aware :root extraction, var() resolution, and the
  fork's icon.png/favicon.ico re-rendered and byte-compared when
  rsvg-convert and magick exist (render determinism verified; graceful
  skip on CI, whose actions also bump to checkout/setup-python v7 and run
  the new --selftest: 24 reintroduced bypass classes, each refused).
  Verified the old way too: every bypass class reintroduced into the real
  sheet failed the run. The CI gate now checks the fork out beside this
  repo (the 2026-09-15 answer to the coupling question), so the icon
  byte-diff runs on CI and Carrel CI reddens on fork icon drift by
  design; the rendered pair stays local.
• The GitHub presentation batch is executed. Releases for v0.9.7,
  v0.9.8 and v0.9.9 are cut from their tags, verbatim bodies
  (--notes-from-tag); the v0.9.7 body publishes its recorded em-dash
  as-is, the 2026-09-15 answer to the force-push question (the tag is the
  immutable record; nothing forward-facing carries the character). The
  README gains a Screenshots section hotlinking the fork's six images from
  smallscope (the coupling is stated right under the heading), the repo
  description now names Carrel-calibre-web, the topics swap landed (docs,
  just and gpl-30 out; design-system, typography and reading-room in), and
  the never-initialized wiki is off.
• The ledger grows its missing rows. .page-count and .reader-state
  join the flex-order, measure, and hairline lists (they rendered serif
  white against the rule's own comment); the dead footer selector is
  gone; the sheet header scopes its "only sheet" claim (the EPUB reader
  and /basic are recorded exceptions); the ramp comment and spec 4.3 tell
  the truth together now: steps 4 to 5 clear 4.5:1, gold 3 measures
  4.37:1 and its values are stated outside the fill.
• The contract catches up (spec amendments, one reviewable batch). §2's
  venv self-contradiction reworded; §4.1 says the caliBlur sheets are not
  served (the theme-1 conditional stays for the rebase diff) and records
  the /basic stock-skin exception with the Kindle-path answer (decision
  #106, 2026-09-14: /basic is not a device surface; the Oasis reads
  through Calibre's own server and KOReader's integration); §4.4 records
  the 2px chart micro-radii exception and the grid series line's mono
  register; §5.3 states the write-guard's real breadth (any linked read
  column, not just enums; the dead enum branch deleted fork-side); §6.2
  gains the series-ledger line; the seven stray curly apostrophes of the
  cquarry-1.1 paste seam are straightened. Last revised moves to
  2026-09-15 (v0.9.10).
• Fork touches under grant #117, logged in both repos. The upstream
  "Book N of SERIES" detail line is removed (the Carrel ledger was
  rendering the same fact twice; spec 6.2 carries the line), the vendored
  sheet is refreshed, and the read-guard's redundant enum branch is gone.
  Suite 86 green after each; the fork's patchnotes carry the blitz log.
• Docs and hygiene. The 0.5.0 entry gets its dated erratum (the engine
  was cquarry's, not "CalibreQuarry's"; the v2.6+ floor named no release
  that ever existed); the 0.9.9 decision anchors are named in words; the
  roadmap's stale Phase 0/13 headers and the below/above pointer are
  fixed; the Browse-verdict sign-off box is closed as decided-and-shipped;
  the 12 dash surrogates and the apostrophe seam are recast;
  README/CLAUDE/CI point at the script docstring instead of restating the
  guard four times; *.bak is ignored and the ruff cache is gone. The
  compound just sync recipe vendors both assets then runs both guards,
  and a bare just is inert. The report-only selector-vs-DOM linter lands
  clean on the live tree (just lint-selectors; it never gates).
• Gates answered and executed this release. The GitHub presentation
  batch (above), the CI sibling checkout (above), the historical-correction
  policy (inline dated errata, decided once; the 0.5.0 and 0.9.9 entries
  and now the 0.7.0 entry carry theirs), the spec spelling convention
  (Canadian English, recorded in the spec header, the split normalized),
  the .gitignore prune (to the library, editor/OS, and scratch blocks),
  and the push itself (standing blitz grant). Still Brandon's: the six
  1.0 sign-off boxes and the DNF marking, recorded as reopen conditions
  in project.done.

v0.9.9: ## 0.9.9 (2026-09-13)

0.9.9 (2026-09-13)

The Categories reposition lands; the contract syncs to the decisions

The 2026-09-12 decision session's Carrel lane, executed as one release
across both repos. The code half is fork 0.6.41; this repo carries the
contract and the theme.

• The sidebar re-balances (fork 0.6.41). A compact Categories
  section renders beneath Wings, above Saved Searches, per decision 32;
  the tree itself is unchanged, only its position and register (the
  theme's compact rows ship through the canonical sheet, vendored by
  just sync-theme). While in the sidebar's code, palette.py's three
  ORM reads (authors, series, tags) moved to cquarry get_entities(),
  so the Ctrl-K index is served from the same source as the about-page
  counts, making the decision note's "served from the cquarry category
  counts" true. Fork suite 73 green (two new tests: the sidebar order
  pin, the palette/get_entities lockstep pin); the README screenshots
  are re-photographed for the new order, with the library's checksum
  identical around the session.
• The single_user.py decorator correction is real now. The roadmap
  claimed the 154/10 comment fix shipped in 230c42bc; the six-lens audit
  found the file still carrying it. Fork 0.6.41 lands the correction:
  39 upstream across 5 modules, 42 across 10 at smallscope HEAD.
• The contract syncs to the decided state. spec §6.3's
  common_filters bullet records the deviation as accepted (decision 33)
  instead of parked; §4.6 describes the reader theme as shipped, with
  the right hex (dragonBlack3); the header's Last revised moves to
  2026-09-13. README and CI describe the 31-hex pin that Phase 13
  actually ships instead of the retired :root declaration guard. The
  glued checkbox in the roadmap is split, Phases 12 and 13 now sit in
  phase order above the sign-off section, and the cquarry three-version
  skew (venv dist-info 1.8.0, editable tree 1.20.0, CI pin 1.17.0) is
  recorded as a noted hazard with its fix shapes.
• Theme hygiene. The duplicated category-tree badge block folds
  away (the .navigation .badge rule already covered it) and a no-op
  hover restatement is dropped. just check and just check-theme
  green.

v0.9.8: ## 0.9.8 (2026-09-11)

0.9.8 (2026-09-11)

The contract catches up: the data-layer swap, the sealing release, a hardened guard

Carrel ships no application code; every code change lives in the fork
(Carrel-calibre-web, smallscope, release 0.6.40). What moved here:

• spec §6.3 is new: the cquarry data layer. The fork's own Phase 7
  (0.6.30-0.6.39) moved the read surfaces to cquarry's list_books behind
  clean-room adapters, and no contract document recorded any of it. The
  new section names the adapter, the surfaces on cquarry, the
  invalidation rule, what deliberately stays on the ORM or the app DB,
  and the common_filters deviation with its decision parked for Brandon.
• The Phase 13 sealing release is executed (fork 0.6.40). Eight
  admin-machinery routes sealed (the updater kill chain was two
  unauthenticated requests with self-mintable CSRF), the send/convert
  chain and TaskBackupMetadata refused in code, per-name fault isolation
  for wings and saved searches, OPDS offset/search/pagination hardening,
  honest SearchError-vs-LibraryUnavailable failure classes, and the
  mode=ro attach plus harness-vs-main blueprint parity pinned as
  committed tests. clean_html.py is upstream byte-for-byte again, about.py
  lost its quote reflow, and the fork's logo derivatives are regenerated
  (the Wave artwork had survived in them since the 2026-08-09 fix).
  Fork suite 71 green, from 108 executions for 60 unique tests.
• The stale contract lines are synced. The §6.2 removal table is
  repainted with the full seal lists; the decorator counts are corrected
  (39 upstream across 5 modules; 42 across 10 at smallscope HEAD); the
  §8.2 floor says cquarry 1.11.1+ editable; the §3 version clause is true
  again; the dead search.py row is gone from §5.3; §12.3 records the
  analytics ride-along; the four surviving em-dashes are recast (the
  0.9.7 entry's stays baked into the pushed v0.9.7 tag: fixing it is a
  tag force-push call, not taken).
• The theme guard is hardened. The palette is pinned (31 hexes from
  spec §4.2 plus §4.3's ramp) instead of derived from :root, which was
  a proven bypass; rgb()/hsl()/named colours are refused; :root is
  found wherever it sits; and the fork's icon.svg is diffed against
  logo.svg when the sibling checkout exists. just sync-logo is the
  recipe that keeps the derivatives true. Verified Phase 11 style, each
  bypass reintroduced.
• Decisions recorded. The homelab auth question is answered: the
  LAN-trust posture stands (spec §11.3; revisit only if the instance
  leaves the LAN). The fork's three audit remainders are routed: the
  audio-branch swap boxed with its work shape, /basic_book boxed low
  priority, the deferred OPDS items waived.
• Phase numbering, disambiguated: the fork's "Phase 7" is its own
  data-layer swap (0.6.30-0.6.39); this repo's Phase 7 is the single-user
  shim (spec §11). Both are recorded in this file by contract; the fork's
  releases below named 0.6.30 "Phase 7 begins" while this repo's Phase 7
  section is something else entirely.

v0.9.7: ## 0.9.7 (2026-09-03)

0.9.7 (2026-09-03)

Phase 7 begins in the fork (0.6.30): the swap's first increments

The contract repo's note for the fork's 0.6.30: the NEW-AUDIT Stage 6
boundary map is written into cquarry's roadmap, and the fork landed the
first data-layer swaps — series awareness through get_entities +
get_all_series, cover resolution through get_cover_path via a shared
mtime-keyed quarry() in library_cache, and an acquisition-pace ledger
on /statistics computed by cquarry.analytics. Theme untouched this
round; check-theme green.